Merge pull request #2632 from splunk/TR-3110

adding risk=other to all configs

bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py

@@ -73,6 +73,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
 
             if hasattr(self.security_content_obj.tags, 'observable') and hasattr(self.security_content_obj.tags, 'risk_score'):
                 for entity in self.security_content_obj.tags.observable:
+
                     risk_object = dict()
                     if entity['type'].lower() in risk_object_user_types:
                         risk_object['risk_object_type'] = 'user'
@@ -85,9 +86,15 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
                         risk_object['risk_object_field'] = entity['name']
                         risk_object['risk_score'] = self.security_content_obj.tags.risk_score
                         risk_objects.append(risk_object)
-                    else:
+
+                    elif 'role' in entity and 'Attacker' in entity['role']:
                         risk_object['threat_object_field'] = entity['name']
                         risk_object['threat_object_type'] = entity['type'].lower()
+                        risk_objects.append(risk_object) 
+                    else:
+                        risk_object['risk_object_type'] = 'other'
+                        risk_object['risk_object_field'] = entity['name']
+                        risk_object['risk_score'] = self.security_content_obj.tags.risk_score
                         risk_objects.append(risk_object)
                         continue
 

detections/application/okta_threatinsight_login_failure_with_high_unknown_users.yml

@@ -27,7 +27,11 @@ tags:
   - T1078
   - T1078.001
   - T1110.004
-  observable: []
+  observable:
+  - name: outcome.reason
+    type: Other
+    role:
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/application/okta_threatinsight_suspected_passwordspray_attack.yml

@@ -27,7 +27,11 @@ tags:
   - T1078
   - T1078.001
   - T1110.003
-  observable: []
+  observable:
+  - name: outcome.reason
+    type: Other
+    role:
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -42,8 +42,8 @@ tags:
     type: Other
     role:
     - Attacker
-  - name: requestedAccountId
-    type: Other
+  - name: user
+    type: User
     role:
     - Victim
   product:

detections/network/dns_query_length_with_high_standard_deviation.yml

@@ -10,9 +10,9 @@ description: This search allows you to identify DNS requests and compute the sta
   standard deviation to show you those queries that are unusually large for your environment.
 data_source: []
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
-  where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")`
+  where NOT DNS.message_type IN("Pointer","PTR") by DNS.query host| `drop_dm_object_name("DNS")`
   | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld)
-  | search tld_len<=24 | eval query_length = len(query) | table query query_length
+  | search tld_len<=24 | eval query_length = len(query) | table host query query_length
   record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS
   avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev
   | `dns_query_length_with_high_standard_deviation_filter`'

detections/network/multiple_archive_files_http_post_traffic.yml

@@ -51,7 +51,7 @@ tags:
   - name: form_data
     type: Other
     role:
-    - Attacker
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/network/plain_http_post_exfiltrated_data.yml

@@ -41,7 +41,7 @@ tags:
   - name: form_data
     type: Other
     role:
-    - Attacker
+    - Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security